DescriptionIn Cacti through 1.2.6, authenticated users may bypass authorization checks (for viewing a graph) via a direct graph_json.php request with a modified local_graph_id parameter.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs941036

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
cacti (PTS)buster1.2.2+ds1-2+deb10u4fixed
buster (security)1.2.2+ds1-2+deb10u6fixed
bullseye (security)1.2.16+ds1-2+deb11u3fixed
bookworm (security)1.2.24+ds1-1+deb12u2fixed
sid, trixie1.2.27+ds1-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
cactisourcejessie(not affected)
cactisourcestretch(not affected)


[stretch] - cacti <not-affected> (vulnerability introduced later)
[jessie] - cacti <not-affected> (vulnerability introduced later)
vulnerability introduced in (release/1.0.0)
see Debian bug report for more information (release/1.2.7) (release/1.2.7)
after further discussion, upstream issued a new fix which reverts previous commits (release/1.2.8)
which turned out to be insufficient to fix the issue, follow up patches: (release/1.2.8) (release/1.2.8) (release/1.2.8)
The original issue mentions only a bypass via graph_json.php but there are
additional permission checks missed while checking the issue fixed with the
upstream commits.

Search for package or bug name: Reporting problems